The University of Texas at San Antonio took academic-campus systems offline after attempted unauthorized activity over the weekend of August 15–16, 2026. Officials said the activity was caught at the network edge, before it reached core systems. The ongoing campus update states the investigation has found no evidence that university data was accessed or exfiltrated.
President Taylor Eighmy delayed the first day of fall classes from Wednesday, August 19 to Monday, August 24 so email, connectivity, and other services could be restored carefully. That is not the same fact pattern as Houston City College / ShinyHunters (published student records) or Texas Tech HSC (Texas AG filing). Do not write “UTSA was breached” from this outage alone.
KSAT and the San Antonio Report confirmed the delay, phone-system downtime, and staggered passphrase resets. Inside Higher Ed reported UTSA has identified a source but has not published it.
Snapshot
| Field | Detail |
|---|---|
| Organization | UT San Antonio (academic campus) |
| Domain | utsa.edu (mail / web) · passphrase.utsa.edu (reset / Duo) |
| Trigger | Attempted unauthorized activity — UTSA wording |
| Containment | Detected at the network edge; systems taken offline |
| Classes | Delayed to Monday, Aug 24, 2026 |
| Confirmed theft / ransom | No — officials report no evidence of exfiltration |
What UTSA has said
From the UT San Antonio Today update (Andrea Marks and CTO Michael Schnabel, Aug 17; later President and Provost notes):
| Date | What changed |
|---|---|
| Weekend ~Aug 15–16 | Unauthorized activity identified; academic campus only |
| Aug 17 | Some services offline; phones down; payment / waitlist tweaks |
| Aug 18 | First day moved to Aug 24; email and connectivity still restoring |
| Aug 20–22 | Staggered student passphrase resets by last-name window |
UTS recommended sending the reset link to a personal email, not a cell phone, because some mobile carriers were failing to deliver codes. That is a phishing moment: unexpected “reset now” mail that is not on the published schedule should be treated as hostile.
What students and staff should do
- Use only the official update page and type passphrase.utsa.edu — do not click a mail button.
- Reset only in your last-name window (or after it). UTSA said resets before 1 a.m. Aug 20 had to be done again.
- Deny Duo pushes you did not start. Report them to Tech Café (210-458-5555 / the address on security.utsa.edu/2faq).
- After you are back in, enroll a hardware token if you can. Unexpected “your aid is ready — sign in here” mail will follow any campus outage.
MFA: YubiKey documented; Google Authenticator is not
UTSA’s second factor is Duo (mandatory on selected services, including myUTSA financial tabs). Official docs recommend a YubiKey when you do not want a phone. They do not document Google Authenticator / open TOTP. Duo SMS and phone callback exist as telephony fallbacks — enroll a key instead of living on SMS.
| Method | Status on UTSA docs |
|---|---|
| Duo Mobile push / Duo passcode | Documented (vendor app) |
| Phone callback / SMS | Documented fallback |
| YubiKey 5 / 5C NFC USB token | Recommended — Tech Café must associate it |
| Google Authenticator / open TOTP | Not documented |
| Passkeys | Not documented |
Directory grade: Strong (documented YubiKey-class token). Vendor Duo push without a key would be Partial; SMS-only would be Fail. HCC stays Fail (Microsoft Authenticator or SMS, no key). Docs: OIS 2FA FAQ · One Stop Duo.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| YubiKey 5 / 5C NFC case | Keychain protection for the key | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP vault | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited UTSA and UT System hosts on August 22, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not prove or disprove the weekend intrusion.
| Organization | Domain | Overall | Identity | Transport | Website | vs 100% |
|---|---|---|---|---|---|---|
| UTSA | utsa.edu | 70% | 90% | 15% | 45% | −30 |
| UT System | utsystem.edu | 54% | 50% | 15% | 43% | −46 |
| Passphrase portal | passphrase.utsa.edu | 34% | 0% | 45% | 40% | −66 |
| News / OIS sites | news.utsa.edu / security.utsa.edu | 28% | 0% | 15% | 37% | −72 |
How to read this table: Type passphrase.utsa.edu yourself. Identity 0% on that host is a no-MX / subdomain pattern — not a reason to follow a lookalike reset link. utsa.edu still sits at 15% transport (same gap as our July Texas colleges listicle).
Audit links: utsa.edu · utsystem.edu · passphrase.utsa.edu · news.utsa.edu · security.utsa.edu
Website stack note
Passive website-tech probes on August 22, 2026:
| Domain | Stack signal |
|---|---|
| utsa.edu / passphrase.utsa.edu | ASP.NET; X-Powered-By exposes the stack |
| news.utsa.edu / security.utsa.edu | No notable CMS flag; HTTPS redirect not confirmed on the probe |
| utsystem.edu | Drupal 11 (probe flagged not at 11.4.5) |
Point-in-time only. An outdated system-office CMS is not proof of this weekend’s edge event.
Blacklist, lookalikes, CourtListener
Email blacklist checks (public DoH, August 22, 2026): utsa.edu, passphrase.utsa.edu, news.utsa.edu, security.utsa.edu, and utsystem.edu were clear on mail/domain lists we can query.
DNS lookalike scan of utsa.edu (registered signals only): 12 to review, 0 likely owned pointing at the brand, 1 BEC staging.
| Lookalike | Technique | Note |
|---|---|---|
| utsa.us | tld-swap | BEC staging (NS, MX) — passphrase-reset bait risk |
| utsa.com / utsa.org / utsa.tech | tld-swap | Registered — investigate, not proof of this incident |
| uta.edu / utsw.edu | omission / adjacent-key | Other UT campuses, not UTSA typosquat |
CourtListener RECAP (Texas Western party search + Western/Southern keyword scan, filed after 2026-08-01): no docket that matches this outage.
Related coverage
- Top Texas colleges & universities email security (
utsa.eduwas 70% in July) - Houston City College ShinyHunters (confirmed published records)
- JPS Fort Worth outage (same “do not write was breached” rule)
- Government & education breaches
- MFA directory — YubiKey, TOTP, passkeys
Run a free audit at audit.emailmenow.com or contact EmailMeNow for campus DMARC / MTA-STS and MFA baselines aimed at the 100% ideal.
Sources: UT San Antonio Today — technology update · KSAT, Aug 18–20, 2026 · San Antonio Report · Inside Higher Ed, Aug 20, 2026 · KSAT expert follow-up · UTSA 2FA FAQ · One Stop Duo. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches August 22, 2026. Domain scores: audit.emailmenow.com only.